I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation rcon(i) = x^(i-1) mod x^8 + x^4 + x^3 + x^1 + 1, for example:

recon(10) = x^(10-1) mod x^8 + x^4 + x^3 + x^1 + 1
x^(9) mod (x^8 + x^4 + x^3 + x^1 + 1)
=> x^5 + x^4 + x^2 + x
=> 0011 0110
=> 0x36 (10th number in RCON Table)

But if i equals to 0 then

rcon(0) = x^(-1) mod x^8 + x^4 + x^3 + x^1 + 1

According to "Wikipedia: Rijndael key schedule ~ Rcon", the first value in Rcon table is 0x8d, which most probably is the value for rcon[0]. I would like to know how it is calculated.

I know how to calculate the mod on paper and this is exactly how I calculated the 0x36 above. But since the power of x is -1 in this case, I am stuck with it. How is rcon[0] calculated in AES?


See my previous answer here regarding rcon calculation:

Rijndael: explanation of Rcon on Wikipedia?

It is essentially caulcated by division of 0x01 within the finite field.

The most important thing about rcon(0) is that there is no round 0, and thus you will never actually use it in any calculation. Also take note of my comment that the Wikipedia page is not completely correct. I will probably edit the page if someone else does not get to it first.

| improve this answer | |
  • 1
    $\begingroup$ Spot on. I think it's sort of disingenuous to include the 0th element, really, even if it is technically correct. In the Rijndael spec given in The Design of Rijndael, Rijmen and Daemen don't even define RC[0], as they call it: they give RC[1], RC[2], and RC[j] for j>2. In FIPS 197, they explicitly state that in Rcon[i], i >= 1. So... $\endgroup$ – Reid Oct 17 '13 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.